A gateway ensures safe access to medical device data for AI agents
A Safety-Bounded SDC-to-MCP Gateway for Medical AI Agents
Distributed, Parallel, and Cluster ComputingArtificial Intelligence
Summary
In hospitals, AI systems can help by using data from medical devices, but it's important that these AI systems do not accidentally control devices in unsafe ways. The authors created a gateway that lets AI agents read medical device data clearly but prevents them from actually sending commands that could cause harm. Their system shows which data is current and valid while keeping AI from making real changes to devices. This approach helps keep AI interactions with medical equipment safe and reliable.
What this means in practice
- •For medical device integrators: Integrate AI systems with medical devices safely by using a gateway that exposes device data for reading without permitting unsafe control actions.
- •For healthcare it teams: Monitor and validate medical device states across different systems with a standardized interface that ensures AI agents receive accurate and up-to-date information.
Authors
Bennet Gerlach, Stefan Fischer
Abstract
The Model Context Protocol (MCP) provides a common interface through which AI applications discover and use external resources and tools. It allows language-model agents to ground their reasoning in current system state and interact with heterogeneous services. In medical environments, however, exposing device state and action affordances requires deterministic constraints on possible effects. We present an IEEE 11073 Service-Oriented Device Connectivity (SDC)-to-MCP gateway that exposes metrics, alarms, context references, and semantic metadata as read-only resources, while representing selected action affordances as policy-validated dry-run tools. The term safety-bounded denotes a narrow no-execution property: agent-facing requests dispatch no SDC device operation. A Python prototype supports simulated fault and lifecycle experiments, a software-reference protocol path spanning independent Java and Python implementations, deterministic baselines, representation ablations, and multi-model agent evaluation. The results show semantically explicit resource exposure, visible rejection of invalid or outdated state, and preservation of the no-execution boundary across resource, proposal, and authorization paths. Explicit semantic metadata improved conformity to required metric identifiers in structured alarm outputs relative to a generic representation, while retained structured-output failures reveal a distinction between plausible narrative answers and task-compliant machine-readable results.